CVE-2026-63922

critical

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_he…

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs are parsed from the current skb head. This matches the existing pattern used in ip6_parse_tlv() after helpers that can modify skb header storage.

CVSS

9.8

9.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

Timeline (UTC)

Published: 2026-07-19 16:17

Modified: 2026-10-27 12:56

NVD status: Analyzed

Last synced 22 hours ago

Verified against the source API 2026-10-28 11:30 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥2.6.19 <5.10.259, ≥5.11 <5.15.210, ≥5.16 <6.1.176, ≥6.2 <6.6.143, ≥6.7 <6.12.93, ≥6.13 <6.18.35

Weakness classification (CWE)

CWE-416

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe

Patch / mitigation: https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1

Patch / mitigation: https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538

Patch / mitigation: https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf

Patch / mitigation: https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f

Patch / mitigation: https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63

Patch / mitigation: https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234

Patch / mitigation: https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99

References

https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b3ac54e5c905f86d22b502eacb5686a282c5659f 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Data sources

NVD CVE API 2.0 — fetched 2026-10-28 11:30 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-63922

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs